R help - Oct 2002 - Any MD5 digests for source files?

Do MD5 digests exist somewhere for the source packages? If not, is there
some other way to verify the integrity of the files we've downloaded?

Thanks.
-- 
Stuart Luppescu -=- s-luppescu at uchicago.edu        
University of Chicago -=- CCSR 
$B:MJ8$HCRF`H~$NIc(B -=-    Kernel 2.4.19-xfs-r1                
There *is* no such thing as a civil engineer. 
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url :
https://stat.ethz.ch/pipermail/r-help/attachments/20021011/0d465628/attachment.bin

On 11 Oct 2002, Stuart Luppescu wrote:
> Do MD5 digests exist somewhere for the source packages? If not, is there
> some other way to verify the integrity of the files we've downloaded?
No, there aren't any things like that.  There have been discussions from
time to time about signing packages, but it never got anywhere.

Without some way to certify public keys it would be less helpful than you
might think. If you download from the central CRAN site in Austria then a
package can only be invalid if either the maintainer's computers were
cracked or if they were misled into accepting a fake package.  In neither
case could you trust CRAN for MD5 digests.

You would need packages to be signed by their authors, using public keys
available independently from CRAN or certified by someone you trust to get
a genuine improvement in security. This would be useful (along the lines
that Debian uses), but it hasn't happened yet.

	-thomas

-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-
r-help mailing list -- Read http://www.ci.tuwien.ac.at/~hornik/R/R-FAQ.html
Send "info", "help", or "[un]subscribe"
(in the "body", not the subject !)  To: r-help-request at
stat.math.ethz.ch
_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._